From 8397a32bcd2893cef2c5681c67635eb0a61fcaa2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 00:18:52 +0200
Subject: [PATCH 1/6] Add a .git dockerignore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
.dockerignore | 1 +
1 file changed, 1 insertion(+)
create mode 100644 .dockerignore
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..6b8710a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+.git
From b9112ec87c0f185651825549bb084de9b7f20ff8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 00:21:47 +0200
Subject: [PATCH 2/6] add a Docker version do_version_check to 1.6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
tests/1_host_configuration.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/tests/1_host_configuration.sh b/tests/1_host_configuration.sh
index 49af272..62b917b 100644
--- a/tests/1_host_configuration.sh
+++ b/tests/1_host_configuration.sh
@@ -40,6 +40,7 @@ fi
# 1.6
check_1_6="1.6 - Keep Docker up to date"
docker_version=`docker version | grep 'Server version' | awk '{print $3}'`
+do_version_check 1.6.2 $docker_version
if [ $? -eq 11 ]; then
warn "$check_1_6"
else
From f905234e7e2994823189c81fed5e908c96c30d78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 00:25:05 +0200
Subject: [PATCH 3/6] Revert "add a Docker version do_version_check to 1.6"
This reverts commit b9112ec87c0f185651825549bb084de9b7f20ff8.
---
tests/1_host_configuration.sh | 1 -
1 file changed, 1 deletion(-)
diff --git a/tests/1_host_configuration.sh b/tests/1_host_configuration.sh
index 62b917b..49af272 100644
--- a/tests/1_host_configuration.sh
+++ b/tests/1_host_configuration.sh
@@ -40,7 +40,6 @@ fi
# 1.6
check_1_6="1.6 - Keep Docker up to date"
docker_version=`docker version | grep 'Server version' | awk '{print $3}'`
-do_version_check 1.6.2 $docker_version
if [ $? -eq 11 ]; then
warn "$check_1_6"
else
From d0d388a8a21a1a6a8c5a420c2fb11163f217a8cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 00:58:49 +0200
Subject: [PATCH 4/6] clean master.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
.dockerignore | 1 -
1 file changed, 1 deletion(-)
delete mode 100644 .dockerignore
diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
index 6b8710a..0000000
--- a/.dockerignore
+++ /dev/null
@@ -1 +0,0 @@
-.git
From 2085e1d4877dd822892239a5cac95beefad28968 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 01:15:20 +0200
Subject: [PATCH 5/6] restrict ps output to root user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
helper_lib.sh | 3 +++
1 file changed, 3 insertions(+)
diff --git a/helper_lib.sh b/helper_lib.sh
index e692deb..8c6cfbb 100644
--- a/helper_lib.sh
+++ b/helper_lib.sh
@@ -1,5 +1,8 @@
#!/bin/sh
+ps_command=$(command -v ps)
+ps_args='-U root -u root -f'
+
# Returns the absolute path of a given string
abspath () { case "$1" in /*)printf "%s\n" "$1";; *)printf "%s\n" "$PWD/$1";; esac; }
From 357a7b616468fc642ad18ddbc194ece170d2c6ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
<konstruktoid@users.noreply.github.com>
Date: Sat, 30 May 2015 01:18:44 +0200
Subject: [PATCH 6/6] use ps variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
tests/2_docker_daemon_configuration.sh | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/tests/2_docker_daemon_configuration.sh b/tests/2_docker_daemon_configuration.sh
index 11a0ea9..46d8307 100644
--- a/tests/2_docker_daemon_configuration.sh
+++ b/tests/2_docker_daemon_configuration.sh
@@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration"
# 2.1
check_2_1="2.1 - Do not use lxc execution driver"
-ps -ef | grep docker | grep lxc >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep lxc >/dev/null 2>&1
if [ $? -eq 0 ]; then
warn "$check_2_1"
else
@@ -14,7 +14,7 @@ fi
# 2.2
check_2_2="2.2 - Restrict network traffic between containers"
-ps -ef | grep docker | grep "icc=false" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "icc=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_2"
else
@@ -23,7 +23,7 @@ fi
# 2.3
check_2_3="2.3 - Set the logging level"
-ps -ef | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1
if [ $? -eq 0 ]; then
warn "$check_2_3"
else
@@ -32,7 +32,7 @@ fi
# 2.4
check_2_4="2.4 - Allow Docker to make changes to iptables"
-ps -ef | grep docker | grep "iptables=false" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "iptables=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then
warn "$check_2_4"
else
@@ -41,7 +41,7 @@ fi
# 2.5
check_2_5="2.5 - Do not use insecure registries"
-ps -ef | grep docker | grep "insecure-registry" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "insecure-registry" >/dev/null 2>&1
if [ $? -eq 0 ]; then
warn "$check_2_5"
else
@@ -50,7 +50,7 @@ fi
# 2.6
check_2_6="2.6 - Setup a local registry mirror"
-ps -ef | grep docker | grep "registry-mirror" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "registry-mirror" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_6"
else
@@ -69,7 +69,7 @@ fi
# 2.8
check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket"
-ps -ef | grep docker | grep "\-H" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then
info "$check_2_8"
info " * Docker daemon running with -H"
@@ -79,9 +79,9 @@ fi
# 2.9
check_2_9="2.9 - Configure TLS authentication for Docker daemon"
-ps -ef | grep docker | grep "tcp://" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "tcp://" >/dev/null 2>&1
if [ $? -eq 0 ]; then
- ps -ef | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
+ $ps_command $ps_args | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_9"
info " * Docker daemon currently listening on TCP"
@@ -96,7 +96,7 @@ fi
# 2.10
check_2_10="2.10 - Set default ulimit as appropriate"
-ps -ef | grep docker | grep "default-ulimit" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "default-ulimit" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_10"
else